In the realm of computer science and, more particularly, the art of operating systems, the term “operating-system process” (or more simply, “process”) is well-known.
Applications are often composed of one or more processes. A process may have one or more threads. A process is typically loaded from storage from one or more load modules. The operating system (OS) is aware of and, indeed, may manage and supervise one or more separate processes running on a computer.
Operating-System Process
Conventionally, OSs support the use of an operating-system process for execution of programs. An operating-system process defines the execution state or context of one or more streams of computer-executable instructions. These streams are sometimes called “threads.”
According to the Microsoft Developers Network (MSDN®) library (at msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/about_processes_and_threads.asp), the concepts of processes and a threads are described in this way:                Each process provides the resources needed to execute a program. A process has a virtual address space, executable code, open handles to system objects, a security context, a unique process identifier, environment variables, a base priority, minimum and maximum working set sizes, and at least one thread of execution. Each process is started with a single thread, often called the primary thread, but can create additional threads from any of its threads.        A thread is the entity within a process that can be scheduled for execution. All threads of a process share its virtual address space and system resources. In addition, each thread maintains exception handlers, a scheduling priority, thread local storage, a unique thread identifier, and a set of structures the system will use to save the thread context until it is scheduled. The thread context includes the thread's set of machine registers, the kernel stack, a thread environment block, and a user stack in the address space of the thread's process. Threads can also have their own security context, which can be used for impersonating clients.        
According to webopedia.com, a process is “an executing program.” Alternatively, webopedia.com defines a process as “an operating system concept that refers to the combination of a program being executed and bookkeeping information used by the operating system. Whenever you execute a program, the operating system creates a new process for it. The process is like an envelope for the program: it identifies the program with a process number and attaches other bookkeeping information to it.”
In conventional OSs, processes are created either statically or dynamically. The components of a statically created process are assembled at “link-time” into a monolithic load module, which is then loaded. The components of a dynamically created process are assembled dynamically, at “load-time” or at “run-time,” from multiple constituent load modules, commonly referred to as Dynamic Link Libraries (DLLs).
With monolithic process architectures (where process components are statically assembled at “link-time” into a monolithic load module), all executable code for the process is pre-packaged into a single load module. With only the single load module, updating components of a process when a constituent change occurs requires the entire process load module to be reconstituted.
Because of that, one can ensure the integrity and security of the executable code within the statically and monolithically created process. In other words, the architecture inherently enables one to identify the code of the process (e.g., via hashing the single load module) so that unauthorized or inappropriate alterations to that code can be reliably detected. In this way, malicious code (from, for example, a “virus,” “worm,” or “spyware”) cannot invade the executable code of a process having stable contents and a stable security statement.
Since all of the code of the process is assembled statically and monolithically, a static analysis on a monolithic load module may accurately determine many useful characteristics of its future execution, such as whether its future execution is stable. Furthermore, an optimization analysis on a monolithic load module may accurately optimize the code for its future execution.
Dynamically assembled process architectures provide more flexibility than monolithic process architectures in updating components of a process. These architectures can potentially save storage and memory space, such as when a single copy of a component can be shared among several processes.
With conventional dynamically assembled process architectures, it is difficult to perform and easy to invalidate stability and optimization analyses. That is because the code for each of the multiple individual components is packaged independent of other components, and each component's execution environment is not known before load time.
Moreover, the components (e.g., DLLs) of a conventional dynamically assembled process can load into a running process, alter the state of that process, and then unload from that process. This may leave the process state altered arbitrarily. Because of this, it is particularly difficult to perform integrity and security analyses on conventional dynamically assembled processes before the code of the process is executed or even while its code is executing.
Recent managed application systems (such as Sun® Java® Runtime or Microsoft® Common Language Runtime (CLR)) go further in allowing arbitrary code generation at runtime, as well as arbitrary code loading. However, even with these advances, there remains a need for construction of operating-system processes, particularly dynamically assembled processes, which can be analyzed for integrity and security.